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WHAT IS CLAIMED IS: 



1 . A method of authenticating a client to ^ server comprising: 
generating a challenge at the client; 

3 signing the challenge to form a signed challenge; 

4 sending at least the signed challenge to the server;/ 

5 verifying the signature of the challenge at the server; and 

6 if the signature is verified, sending an indication/of successful authentication to the 

7 client. 

1 2. The method of claim 1, wherein generating a challenge at the client 

2 comprises generating a random number. ^ 

3. The method of claim 1, w^herein generating a challenge at the client 

O 

g comprises generating a sequential challenge. 

4. The method of claim 1, wheriin generating a challenge at the client 
comprises generating a challenge based on da|ja received from the server in a prior step. 

/ 

^ 5. The method of claim 4, wherein the data received from the server is a 

W challenge retumed with a server response to /a prior client query. 

UJ. '/ 

^ 6. A method of using a one-time use card nimiber for an online transaction, 

^ comprising: / 

3 generating a one-time use card numbfer at a user system; 

1 

4 authenticating the user systeni to an^issuer system; 

5 passing the one-time use card numl^er from the user system to the issuer system; 

6 passing the one-time use card number from the user system to a merchant system, 

7 wherein the merchant system is programmed to present the one-time use card 

8 number to the issuer system t6 effect a payment; 

9 verifying the one-time use card number received from the merchant system with the one- 

10 time use card number received from the user system; and 

11 if the one-time use card numbejis verified, approving the transaction. 

1 7. The method of claim 6, wherein passing the one-time use card nvunber to 

2 the issuer includes passing at least one other data element related to the online transaction. 
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8. The method ot claim 7, wherein the at least one other data element is 
selected from, or a function o£ a user's account number, a usefs private key, a transaction 
time, a transaction amount, or a merchant ID. 
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